topic Re: Splunk Search regex in Splunk Search

Splunk Search regex

avsplunkuser007 — Tue, 25 Aug 2020 16:52:36 GMT

Hello,

My first post!!!

I have a bunch of results that show up when searched. One of the example is

Aug 5 19:08:12 ServerName Aug 5, 2020 19:08:12 GMT|50000|APP|UNKNOWN|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|443|XXXXX|-|/someprocess.php|-|A message posted successfully|500

Aug 5 19:08:10 ServerName Aug 5, 2020 19:08:10 GMT|50000|APP|UNKNOWN|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|443|XXXXX|-|/newprocess.php|-|A message posted successfully|200

I want to do a stats count by the .php processes. So, how do i add these or eval/stats these .php processes / scripts ?

Re: Splunk Search regex

ITWhisperer — Tue, 25 Aug 2020 17:40:17 GMT

It looks like the script name is the 11th field assuming "|" is the delimiter so something like this might work

Indexes start at zero so index 10 for the 11th field

Re: Splunk Search regex

richgalloway — Tue, 25 Aug 2020 17:47:42 GMT

Welcome!

To do stats on the field you first need to extract it. The rex command does that.

index=foo | rex "\/(?<file>\w+\.\w+)" | stats count by file

Re: Splunk Search regex

thambisetty — Tue, 25 Aug 2020 18:06:20 GMT

The events look like very much structured and values are delimited with pipe symbol.

you can use IFX(Interactive Field Extraction) to extract them very nicely.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/ExtractfieldsinteractivelywithIFX

Re: Splunk Search regex

isoutamo — Tue, 25 Aug 2020 21:46:52 GMT

And adding more Splunk features here, you could do this with props.conf and transforms.conf on search heads on search time ,-)

All these suggestions will work, it's your chose to select which own is best for your current needs.

r. Ismo

Re: Splunk Search regex

Anam — Wed, 26 Aug 2020 00:03:13 GMT

Welcome to Splunk Answers! avesplunkuser007 We have some awesome contributors who help out users actively. Feel free to message me if you have any questions or concerns.